II 

115TH CONGRESS 

1ST SESSION S. 1281 

To establish a bug bounty pilot program within the Department of Homeland 

Security, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MAY 25, 2017 

Ms. HASSAN (for herself, Mr. PORTMAN, Mrs. MCCASKILL, and Ms. HARRIS) 

introduced the following bill; which was read twice and referred to the 

Committee on Homeland Security and Governmental Affairs 

A BILL 

To establish a bug bounty pilot program within the 

Department of Homeland Security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Hack the Department 

5 of Homeland Security Act of 2017’’ or the ‘‘Hack DHS 

6 Act’’. 

7 SEC. 2. DEPARTMENT OF HOMELAND SECURITY BUG BOUN8 TY PILOT PROGRAM. 

9 (a) DEFINITIONS.—In this section: 


SSpencer on DSKBBV9HB2PROD with BILLS
2 

•S 1281 IS

1 (1) BUG BOUNTY PROGRAM.—The term ‘‘bug 

2 bounty program’’ means a program under which an 

3 approved computer security specialist or security re4 searcher is temporarily authorized to identify and re5 port vulnerabilities within the information system of 

6 the Department in exchange for cash payment. 

7 (2) DEPARTMENT.—The term ‘‘Department’’ 

8 means the Department of Homeland Security. 

9 (3) INFORMATION SYSTEM.—The term ‘‘infor10 mation system’’ has the meaning given the term in 

11 section 3502 of title 44, United States Code. 

12 (4) PILOT PROGRAM.—The term ‘‘pilot pro13 gram’’ means the bug bounty pilot program required 

14 to be established under subsection (b)(1). 

15 (5) SECRETARY.—The term ‘‘Secretary’’ means 

16 the Secretary of Homeland Security. 

17 (b) ESTABLISHMENT OF PILOT PROGRAM.— 

18 (1) IN GENERAL.—Not later than 180 days 

19 after the date of enactment of this Act, the Sec20 retary shall establish a bug bounty pilot program to 

21 minimize vulnerabilities to the information systems 

22 of the Department. 

23 (2) REQUIREMENTS.—In establishing the pilot 

24 program, the Secretary shall— 


SSpencer on DSKBBV9HB2PROD with BILLS
3 

•S 1281 IS

1 (A) provide monetary compensation for re2 ports of previously unidentified security 

3 vulnerabilities within the websites, applications, 

4 and other information systems of the Depart5 ment that are accessible to the public; 

6 (B) develop an expeditious process by 

7 which computer security researchers can reg8 ister with the Department, submit to a back9 ground check as determined by the Depart10 ment, and receive a determination as to ap11 proval for participation in the pilot program; 

12 (C) designate mission-critical operations 

13 within the Department that should be excluded 

14 from the pilot program; 

15 (D) consult with the Attorney General on 

16 how to ensure that computer security specialists 

17 and security researchers who participate in the 

18 pilot program are protected from prosecution 

19 under section 1030 of title 18, United States 

20 Code, and similar provisions of law for specific 

21 activities authorized under the pilot program; 

22 (E) consult with the relevant offices at the 

23 Department of Defense that were responsible 

24 for launching the 2016 ‘‘Hack the Pentagon’’ 


SSpencer on DSKBBV9HB2PROD with BILLS
4 

•S 1281 IS

1 pilot program and subsequent Department of 

2 Defense bug bounty programs; 

3 (F) award competitive contracts as nec4 essary to manage the pilot program and for 

5 executing the remediation of vulnerabilities 

6 identified as a consequence of the pilot pro7 gram; and 

8 (G) engage interested persons, including 

9 commercial sector representatives, about the 

10 structure of the pilot program as constructive 

11 and to the extent practicable. 

12 (c) REPORT.—Not later than 90 days after the date 

13 on which the pilot program is completed, the Secretary 

14 of Homeland Security shall submit to the Committee on 

15 Homeland Security and Governmental Affairs of the Sen16 ate and the Committee on Homeland Security of the 

17 House of Representatives a report on the pilot program, 

18 which shall include— 

19 (1) the number of computer security research20 ers involved in the pilot program, broken down by 

21 the number of computer security researchers who— 

22 (A) registered; 

23 (B) were approved; 

24 (C) submitted security vulnerabilities; and 

25 (D) received monetary compensation; 


SSpencer on DSKBBV9HB2PROD with BILLS
5 

•S 1281 IS

1 (2) the number and severity of previously un2 identified vulnerabilities reported as part of the pilot 

3 program; 

4 (3) the number of previously unidentified secu5 rity vulnerabilities remediated as a result of the pilot 

6 program; 

7 (4) the average length of time between the re8 porting of security vulnerabilities and remediation of 

9 the vulnerabilities; 

10 (5) the average amount of monetary compensa11 tion paid per unique vulnerability submitted under 

12 the pilot program and the total amount of monetary 

13 compensation paid to computer security researchers 

14 under the pilot program; and 

15 (6) the lessons learned from the pilot program. 

16 (d) AUTHORIZATION OF APPROPRIATIONS.—There 

17 are authorized to be appropriated to the Department 

18 $250,000 for fiscal year 2018 to carry out this Act. 

Æ 


SSpencer on DSKBBV9HB2PROD with BILLS